Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?



WordPress 6.4.2 Patches Remote Code Execution Vulnerability

WordPress 6.4.2 patches a flaw that could be chained with another vulnerability to execute arbitrary code.

WordPress this week released a security update for the popular content management system (CMS) to address a remote code execution (RCE) vulnerability.

The flaw addressed in the open source CMS is a property oriented programming (POP) chain issue introduced in WordPress core 6.4. It can be combined with a different object injection flaw, allowing attackers to execute PHP code on vulnerable websites.

The bug was identified in a class that was introduced in WordPress 6.4 to improve HTML parsing in the block editor, the Wordfence team at WordPress security company Defiant explains.

The vulnerable class includes a function that is executed automatically after PHP has processed a request, and which uses properties that an attacker may have full control of.

“While WordPress Core currently does not have any known object injection vulnerabilities, they are rampant in other plugins and themes. The presence of an easy-to-exploit POP chain in WordPress core substantially increases the danger level of any Object Injection vulnerability,” Wordfence explains.

In its advisory, WordPress notes that the RCE flaw is not exploitable directly in core, but that, when combined with some plugins, it may pose a high risk.

To resolve the issue, WordPress added a new method that prevents the vulnerable function from executing, thus preventing exploitation.

The RCE bug was patched in WordPress 6.4.2. Site owners and administrators are advised to update to the fixed CMS version as soon as possible.

Advertisement. Scroll to continue reading.

While there are no indicators that the vulnerability is being exploited in malicious attacks, bugs in WordPress and associated plugins have long been an attractive target for threat actors.

“While most sites should automatically update to WordPress 6.4.2, we strongly recommend manually checking your site to ensure that it is updated,” Wordfence notes.

Related: Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin

Related: Recently Patched TagDiv Plugin Flaw Exploited to Hack Thousands of WordPress Sites

Related: Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks

Related: Critical WordPress Plugin Vulnerabilities Impact Thousands of Sites

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Bill Dunnion has joined telecommunications giant Mitel as Chief Information Security Officer.

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

More People On The Move

Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.